Hello,
Could someone explain me the following strange behavior with search
With this type of search :
sourcetype="cisco:esa:textmail" | transaction internal_message_id | search "My_email_address@address.com"
When i make a search on last 15 minutes, last hour or last 4 hours, my search work and return me answers .
If i use a specified period time it work too.
As soon as i use 24hours or more, the search give me no answer.
How to explain this ?
Sorry for my english and thanks in advance
... View more